AntiFox AI Pentesting Tool Linked to AWS Secret Theft

Estimated reading time: 7 minutes · Last updated: 11 November 2026

Arctic Wolf Labs has linked the AntiFox AI pentesting platform, an open-source project hosted on GitHub, to live intrusions that moved from compromised web servers and stolen cloud identities into Amazon Web Services (AWS) accounts. In at least some cases the attackers made a successful GetSecretValue call against a production secret. GetSecretValue is the Secrets Manager request that retrieves a stored secret. Arctic Wolf tied the activity to Alibaba Cloud systems hosting AntiFox interfaces. The disclosure comes as defenders track a wider family of agentic attack tools, ARTEX among them. These tools let an operator set a goal and leave software to pursue it.

Agentic frameworks such as these make penetration testing techniques more accessible to threat actors, while increasing the speed and consistency with which these techniques can be applied in live attacks.

Arctic Wolf Labs

What AntiFox Promises and How It Was Misused

AntiFox's maintainer presents it as an autonomous, AI-driven penetration testing platform. Penetration testing is the authorised practice of attacking systems to find weaknesses before criminals do. The project's English README describes three agents working together: a planner, a worker and a main agent. They operate over two graphs, one mapping all known assets and one tracking exploration for each task, as work moves from reconnaissance to a delivered report.

The maintainer's pitch is follow-through. Many tools stop once they have found problems. AntiFox aims to produce evidence that an engineer can reproduce and hand to a client. Every engagement is framed around an authorised target. When Arctic Wolf's findings were published, the repository had 251 forks and 474 stars.

That framing has not held in practice. Arctic Wolf said Alibaba Cloud systems hosting AntiFox interfaces were associated with confirmed malicious activity. The targets were exposed web services and the AWS environments connected to them.

How the IIS Web Shell Chain Worked

One way in was a compromised IIS (Internet Information Services) application facing the internet. IIS runs web code inside a worker process, w3wp.exe. Arctic Wolf saw that process create an ASPX web shell, a server-side script that accepts commands over the web. The same process then ran operating system commands. The company said this points to compromise through the web application, though the exact flaw behind the code execution is unknown.

The first commands helped the intruder get their bearings. They ran whoami to learn the account context and listed the application directory. They used icacls to check permissions and tested whether they could write files to the web root.

Next, PowerShell searched for web.config files and configuration backups. The attackers read application settings and database connection strings and went through debug and error-log folders. They took a credential from the configuration and tried it against an internal production database. Finally, they copied configuration and log files into an upload directory reachable from the web, ready to be pulled out.

How a Valid AWS Identity Reached a Production Secret

A second path skipped the web server. Here the threat actor began with a working AWS credential, obtained by means Arctic Wolf has not yet established. Valid IAM identities were used to confirm the credential and then sweep the account.

The sweep was wide. It covered compute services including EC2, Lambda, ECS and EKS, and data stores such as S3, DynamoDB, RDS, Redshift, Athena and Glue. It also reached security tooling in IAM, KMS and Secrets Manager, plus CloudWatch, CloudFormation, Systems Manager, API Gateway and Amazon Bedrock.

Arctic Wolf said most of those authenticated cross-service requests were refused with AccessDenied errors. Some discovery and secret-access calls went through. In at least some instances, the actor moved from listing Secrets Manager entries to a successful GetSecretValue request on a production secret. In another case, a valid identity ran S3 discovery and object operations through API calls.

That mix is itself a detection clue. One identity piling up AccessDenied errors across unrelated services came before the calls that worked.

What ARTEX Reveals About Agentic Attacks at Scale

ARTEX, a separate AI-powered pentesting tool, shows how widely this model already runs. Censys counted 1,465 hosts running an exposed ARTEX console as of 4 November 2026. Most were in the U.S., Hong Kong, China, Japan, Singapore and South Korea, though Censys cautioned that not every one is malicious. Check Point Research identified 2,557 systems hosting ARTEX. Ten of them were misconfigured badly enough to expose their full databases.

Check Point found that operators did little steering: 'Rather than continuously directing attacks step by step, operators frequently issued a goal and left the agent fleet to work toward it.' Most attacks went after cryptocurrency, Apple code-signing certificates and gaming accounts, or ran denial-of-service attacks on gambling sites. They exploited missing authentication, insecure direct object references, remote code execution, and weak or hard-coded passwords.

In the certificate campaign, agents searched compromised machines for certificate databases. They then checked each find against its password, private key, Apple revocation status, expiry date and provisioning profiles. More than 300 certificates and their passwords are estimated to have been collected. Three passed every check and could sign arbitrary iOS applications.

CERT-EU said in an alert that ARTEX matters because of 'its scale, speed and persistence'. It noted the tool can work through many simple misconfigurations that a person might spot but never get round to testing.

Ghost-Campus Shows Agents Stealing the Compute They Run On

VECERT disclosed a related case, Operation Ghost-Campus, which it attributes to a Chinese threat actor. AI agents kept the operation supplied with free access to large language models (LLMs). That access then supported automated academic fraud and the theft of data on more than 5,000 students at the Fengxian Campus.

VECERT described how the agent worked. It mass-registered accounts on the fofa.info search engine and scanned for misconfigured servers. It extracted OpenAI and DeepSeek API keys, checked their remaining balances and loaded them into the attacker's development environment. That stolen compute drove a GoTTY terminal labelled 'Pi — AI Coding Assistant' and the heartbeat bots that kept the fraud running.

AntiFox and ARTEX are two of roughly 45 agentic attack frameworks with public source code. Each is built to connect to an LLM and act on what it returns, and the table below sorts them into five categories. GitGuardian summed up the danger: 'A GitHub search, a scanner download, and a found key passed to the next call are all one prompt away, even though none of it ships in the repository.'

What limits and what amplifies the threat

The bottom line

Arctic Wolf described no novel technique in the AntiFox chain. Web shells, scraped configuration files and stolen cloud keys are familiar tradecraft. What has changed is who can run the full sequence, and how quickly, which is Arctic Wolf's central warning. A README that speaks of authorised targets did nothing to prevent misuse. Two gaps remain open: the IIS flaw that gave attackers code execution, and the origin of the starting AWS credential. Until both are known, the practical signals sit in the logs. Watch for worker processes that spawn shells, and for single identities stacking up AccessDenied errors before one request finally lands.

What to watch

• Watch for Arctic Wolf Labs or another researcher to name the vulnerability that gave attackers code execution on the IIS server; no date has been set.
• Watch for an explanation of how the attackers obtained their starting AWS credential, which Arctic Wolf has not yet determined; no timetable exists.
• Watch for a fresh Censys count of exposed ARTEX consoles to compare against the 1,465 recorded on 4 November 2026; no date for a new tally has been announced.